All Apps and Add-ons

General DB files question.

uayub
Path Finder

There are files such as db_1350734407_1350313059_152-tmp in the defaultdb/db folder.
What are these files ending in tmp? When a search is performed, it seems the data that is in these files are not indexed. How do I tell splunk to index such files?

Thanks for your assistance.
UA

Tags (3)
1 Solution

Rob
Splunk Employee
Splunk Employee

These are temporary files that are created by the online fsck process when Splunk detects a bad index and tries to restore the buckets for that index. They are essentially, a working copy to use for restoring the index until the index has been restored to a good state. Once the -tmp folder has restored all the data for the working copy, it will then replace the same named folder. This is to ensure that data is not lost while the restoration is running.

Sometimes, these -tmp folders can be left behind if the online fsck process exits ungracefully. Generally, it should be safe to delete the folder as it is only a copy of the same named db_* folder in the same directory. The online fsck tool will simply re-create the -tmp folder if it is needed again.

More info on online fsck can be had here: http://wiki.splunk.com/Check_and_Repair_Metadata

View solution in original post

Rob
Splunk Employee
Splunk Employee

These are temporary files that are created by the online fsck process when Splunk detects a bad index and tries to restore the buckets for that index. They are essentially, a working copy to use for restoring the index until the index has been restored to a good state. Once the -tmp folder has restored all the data for the working copy, it will then replace the same named folder. This is to ensure that data is not lost while the restoration is running.

Sometimes, these -tmp folders can be left behind if the online fsck process exits ungracefully. Generally, it should be safe to delete the folder as it is only a copy of the same named db_* folder in the same directory. The online fsck tool will simply re-create the -tmp folder if it is needed again.

More info on online fsck can be had here: http://wiki.splunk.com/Check_and_Repair_Metadata

Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...